Show filters
155 Total Results
Displaying 1-10 of 155
Sort by:
Attacker Value
Unknown
CVE-2021-37349
Disclosure Date: August 13, 2021 (last updated November 28, 2024)
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.
1
Attacker Value
Unknown
CVE-2024-24402
Disclosure Date: February 26, 2024 (last updated February 13, 2025)
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component.
0
Attacker Value
Unknown
CVE-2023-51072
Disclosure Date: February 02, 2024 (last updated February 10, 2024)
A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.
0
Attacker Value
Unknown
CVE-2021-43584
Disclosure Date: January 24, 2024 (last updated February 01, 2024)
DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log.
0
Attacker Value
Unknown
CVE-2023-48085
Disclosure Date: December 14, 2023 (last updated December 20, 2023)
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
0
Attacker Value
Unknown
CVE-2023-48084
Disclosure Date: December 14, 2023 (last updated December 20, 2023)
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.
0
Attacker Value
Unknown
CVE-2023-40934
Disclosure Date: September 19, 2023 (last updated October 08, 2023)
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.
0
Attacker Value
Unknown
CVE-2023-40933
Disclosure Date: September 19, 2023 (last updated October 08, 2023)
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
0
Attacker Value
Unknown
CVE-2023-40932
Disclosure Date: September 19, 2023 (last updated October 08, 2023)
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.
0
Attacker Value
Unknown
CVE-2023-40931
Disclosure Date: September 19, 2023 (last updated October 08, 2023)
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php
0
